Within a Microsoft Active Directory domain, an organizational unit (OU) is a container that may host users, groups, and machines. An administrator can give Group Policy settings or account rights to this smallest unit. Multiple OUs can exist within an organizational unit, but all characteristics within the contained OU must be unique. Objects from other domains cannot be included in Active Directory organizational units.